@harperfast/harper 5.2.13 → 5.3.0-beta.1

package/dist/resources/transactionBroadcast.js.map

@@ -1 +1 @@
-{"version":3,"file":"transactionBroadcast.js","sourceRoot":"","sources":["../../resources/transactionBroadcast.ts"],"names":[],"mappings":";;AAiBA,0CAyEC;AAsMD,0CAkCC;AAUD,kDAeC;AA3VD,0EAA2D;AAC3D,mEAA6D;AAC7D,iDAAkD;AAGlD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AAC3F,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AACrG;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,QAAuB,EAAE,SAAkB,EAAE,OAAa;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3C,sGAAsG;IACtG,iEAAiE;IACjE,IAAI,qBAAqB,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;QACrC,6GAA6G;QAC7G,qBAAqB,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpG,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,qBAAqB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC;YAC/C,IAAI,gBAAgB,CAAC;YACrB,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACjC,iHAAiH;gBACjH,4FAA4F;gBAC5F,8CAA8C;gBAC9C,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,UAAU,CAAC,6BAA6B,GAAG,IAAI,CAAC;YAChD,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,sFAAsF;YACtF,iFAAiF;YACjF,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC;oBACxC,mFAAmF;oBACnF,kFAAkF;oBAClF,yEAAyE;oBACzE,IAAI,UAAU,CAAC,eAAe;wBAAE,eAAe,CAAC,UAAU,CAAC,CAAC;oBAC5D,OAAO;gBACR,CAAC;gBACD,IAAI,qBAAqB,CAAC,eAAe;oBAAE,OAAO;gBAClD,qBAAqB,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC7C,YAAY,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,qBAAqB,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpD,IAAI,qBAAqB,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/C,qBAAqB,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO;IACR,CAAC;IACD,IAAI,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzB,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QAChE,kBAAkB,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAChD,kBAAkB,CAAC,OAAO,GAAG,OAAO,CAAC;QACrC,kBAAkB,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,GAAG,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,YAAY,CAAC,SAAS,GAAG,SAAS,CAAC;IACnC,IAAI,aAAa,GAAQ,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,aAAa;QAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC/C,CAAC;QACL,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9D,aAAa,CAAC,MAAM,GAAG,kBAAkB,CAAC;QAC1C,aAAa,CAAC,GAAG,GAAG,GAAG,CAAC;IACzB,CAAC;IACD,YAAY,CAAC,aAAa,GAAG,aAAa,CAAC;IAC3C,qBAAqB,CAAC,WAAW,GAAG,CAAC,qBAAqB,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjF,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,YAAa,SAAQ,0CAAkB;IAC5C,QAAQ,CAAgF;IACxF,aAAa,CAAM;IACnB,SAAS,CAAU;IACnB,kBAAkB,CAAW;IAC7B,oBAAoB,CAAW;IAC/B,YAAY,CAAW;IACvB,YAAY,QAAQ;QACnB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,GAAG;QACF,UAAU;QACV,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YACrD,MAAM,gBAAgB,GAAG,kBAAkB,EAAE,IAAI,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,kBAAkB,EAAE,CAAC;oBACxB,mCAAmC;oBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;oBACnC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAI,kBAAkB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBACnC,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;oBACrD,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,gBAAgB,EAAE,WAAW,GAAG,CAAC;gBAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACtE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IACD,MAAM;QACL,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;CACD;AACD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAChF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,SAAS,yBAAyB,CAAC,aAAa,EAAE,gBAAiB,EAAE,UAAU,GAAG,KAAK;IACtF,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,oEAAoE;IAChG,+FAA+F;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAChC,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,4CAA4C;QACxF,IAAI,UAAU;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;QACtD,OAAO;IACR,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;IAC5C,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;IAC5B,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,0FAA0F;IAC1F,kDAAkD;IAClD,IAAI,mBAAmB,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,8EAA8E;QAC9E,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,aAAa,CAAC,WAAW;YAChC,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACJ,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,iEAAiE;gBACjE,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,2CAA2C;gBAC3C,IAAA,uBAAI,EAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;gBAC9E,MAAM;YACP,CAAC;YACD,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YACjC,MAAM,SAAS,GAAW,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC;YACvE,aAAa,CAAC,WAAW,GAAG,SAAS,CAAC;YACtC,uFAAuF;YACvF,6FAA6F;YAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7E,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;oBACtC,mCAAmC;oBACnC,IAAI,WAAW,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,aAAa,GAAG,CAAC,CAAC;oBACtB,GAAG,CAAC;wBACH,gFAAgF;wBAChF,uIAAuI;wBACvI,iEAAiE;wBACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC7D,IAAI,gBAAgB,EAAE,CAAC;4BACtB,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;gCAC7C,IACC,aAAa,GAAG,CAAC,IAAI,sGAAsG;oCAC3H,CAAC,CAAC,YAAY,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;oCAEvF,SAAS;gCACV,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oCACzC,SAAS;gCACV,CAAC;gCACD,IAAI,CAAC;oCACJ,IAAI,QAAQ,CAAC;oCACb,IAAI,YAAY,CAAC,oBAAoB,IAAI,YAAY,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;wCAChF,8FAA8F;wCAC9F,uFAAuF;wCACvF,0DAA0D;wCAC1D,QAAQ,GAAG,IAAI,CAAC;wCAChB,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;4CACjC,uGAAuG;4CACvG,IAAI,CAAC,mBAAmB;gDAAE,mBAAmB,GAAG,CAAC,YAAY,CAAC,CAAC;;gDAC1D,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wCAC7C,CAAC;wCACD,YAAY,CAAC,aAAa,GAAG,MAAM,CAAC;oCACrC,CAAC;oCACD,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gCACnE,CAAC;gCAAC,OAAO,KAAK,EAAE,CAAC;oCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;gCACb,CAAC;4BACF,CAAC;wBACF,CAAC;wBACD,IAAI,WAAW,IAAI,IAAI;4BAAE,MAAM;wBAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzE,IAAI,SAAS,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1C,aAAa,EAAE,CAAC,CAAC,8EAA8E;wBAChG,CAAC;wBACD,IAAI,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;4BACpB,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;wBACnD,CAAC;;4BAAM,WAAW,GAAG,IAAI,CAAC;oBAC3B,CAAC,QAAQ,IAAI,EAAE;gBAChB,CAAC;YACF,CAAC;iBAAM,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,6FAA6F;gBAC7F,gGAAgG;gBAChG,kGAAkG;gBAClG,iGAAiG;gBACjG,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;wBAC5D,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;4BAC7C,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS;gCAAE,SAAS;4BAClD,IAAI,CAAC;gCACJ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;4BAC5D,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;4BACb,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,UAAU,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,CAAC;gBACpD,iFAAiF;gBACjF,oFAAoF;gBACpF,yFAAyF;gBACzF,4FAA4F;gBAC5F,aAAa,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;gBAC1D,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,CACjB,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CACrG,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAC3C,IAAI,mBAAmB,EAAE,CAAC;YACzB,iHAAiH;YACjH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;gBAChD,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW;gBAC9C,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnF,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,0FAA0F;QAC1F,iFAAiF;QACjF,IAAI,UAAU,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;IACnE,CAAC;AACF,CAAC;AACD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,YAAY,EAAE,UAAU;IACvD,MAAM,KAAK,GAAG,UAAU,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACrC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE;YACtC,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,wEAAwE;YAChI,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,uFAAuF;YACvF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7D,CAAC;YACD,0KAA0K;YAC1K,MAAM,YAAY,GAAG,GAAG,EAAE;gBACzB,wHAAwH;gBACxH,IAAI,CAAC,KAAK,CAAC,iBAAiB;oBAC3B,uCAAuC;oBACvC,KAAK,CAAC,iBAAiB,GAAG,IAAI,YAAY,CACzC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;gBACH,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,sBAAsB;gBACxF,IAAI,CAAC;oBACJ,yBAAyB,CAAC,aAAa,CAAC,CAAC;gBAC1C,CAAC;wBAAS,CAAC;oBACV,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,uBAAuB;oBAC/E,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB;gBAC7D,CAAC;YACF,CAAC,CAAC;YACF,iCAAiC;YACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,YAAY,CAAC;gBAAE,OAAO;YAChE,YAAY,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AACD,SAAS,eAAe,CAAC,UAAU;IAClC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;IACtC,IAAI,WAAW,CAAC;IAChB,UAAU,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,WAAW,GAAG,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,CAAC,OAAO,GAAG,WAAW,CAAC;AAClD,CAAC;AAED,SAAgB,mBAAmB,CAAC,UAAU;IAC7C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;QACjC,eAAe,CACd;YACC,YAAY,EAAE,UAAU;YACxB,UAAU;SACV,EACD,IAAI,EACJ,IAAI,EACJ,CAAC,EACD,EAAE,KAAK,EAAE,eAAe,EAAE,CAC1B,CAAC;QACF,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,eAAe,CAAC;AACnC,CAAC"}
+{"version":3,"file":"transactionBroadcast.js","sourceRoot":"","sources":["../../resources/transactionBroadcast.ts"],"names":[],"mappings":";;AAiBA,0CAyEC;AAsMD,0CAkCC;AAUD,kDAeC;AA3VD,0EAA2D;AAC3D,mEAA6D;AAC7D,iDAAkD;AAGlD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AAC3F,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AACrG;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,QAAuB,EAAE,SAAkB,EAAE,OAAa;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3C,sGAAsG;IACtG,iEAAiE;IACjE,IAAI,qBAAqB,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;QACrC,6GAA6G;QAC7G,qBAAqB,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpG,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,qBAAqB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC;YAC/C,IAAI,gBAAgB,CAAC;YACrB,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACjC,iHAAiH;gBACjH,4FAA4F;gBAC5F,8CAA8C;gBAC9C,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,UAAU,CAAC,6BAA6B,GAAG,IAAI,CAAC;YAChD,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,sFAAsF;YACtF,iFAAiF;YACjF,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC;oBACxC,mFAAmF;oBACnF,kFAAkF;oBAClF,yEAAyE;oBACzE,IAAI,UAAU,CAAC,eAAe;wBAAE,eAAe,CAAC,UAAU,CAAC,CAAC;oBAC5D,OAAO;gBACR,CAAC;gBACD,IAAI,qBAAqB,CAAC,eAAe;oBAAE,OAAO;gBAClD,qBAAqB,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC7C,YAAY,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,qBAAqB,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpD,IAAI,qBAAqB,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/C,qBAAqB,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO;IACR,CAAC;IACD,IAAI,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzB,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QAChE,kBAAkB,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAChD,kBAAkB,CAAC,OAAO,GAAG,OAAO,CAAC;QACrC,kBAAkB,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,GAAG,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,YAAY,CAAC,SAAS,GAAG,SAAS,CAAC;IACnC,IAAI,aAAa,GAAQ,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,aAAa;QAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC/C,CAAC;QACL,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9D,aAAa,CAAC,MAAM,GAAG,kBAAkB,CAAC;QAC1C,aAAa,CAAC,GAAG,GAAG,GAAG,CAAC;IACzB,CAAC;IACD,YAAY,CAAC,aAAa,GAAG,aAAa,CAAC;IAC3C,qBAAqB,CAAC,WAAW,GAAG,CAAC,qBAAqB,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjF,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,YAAa,SAAQ,0CAAkB;IAC5C,QAAQ,CAAgF;IACxF,aAAa,CAAM;IACnB,SAAS,CAAU;IACnB,kBAAkB,CAAW;IAC7B,oBAAoB,CAAW;IAC/B,YAAY,CAAW;IACvB,YAAY,QAAQ;QACnB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,GAAG;QACF,UAAU;QACV,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YACrD,MAAM,gBAAgB,GAAG,kBAAkB,EAAE,IAAI,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,kBAAkB,EAAE,CAAC;oBACxB,mCAAmC;oBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;oBACnC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAI,kBAAkB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;wBACnC,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;oBACrD,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,gBAAgB,EAAE,WAAW,GAAG,CAAC;gBAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACtE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IACD,MAAM;QACL,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;CACD;AACD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAChF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,SAAS,yBAAyB,CAAC,aAAa,EAAE,gBAAiB,EAAE,UAAU,GAAG,KAAK;IACtF,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,oEAAoE;IAChG,+FAA+F;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAChC,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,4CAA4C;QACxF,IAAI,UAAU;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;QACtD,OAAO;IACR,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;IAC5C,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;IAC5B,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,0FAA0F;IAC1F,kDAAkD;IAClD,IAAI,mBAAmB,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,8EAA8E;QAC9E,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,aAAa,CAAC,WAAW;YAChC,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACJ,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,iEAAiE;gBACjE,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,2CAA2C;gBAC3C,IAAA,uBAAI,EAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;gBAC9E,MAAM;YACP,CAAC;YACD,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YACjC,MAAM,SAAS,GAAW,WAAW,CAAC,SAAS,CAAC;YAChD,aAAa,CAAC,WAAW,GAAG,SAAS,CAAC;YACtC,uFAAuF;YACvF,2FAA2F;YAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7E,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;oBACtC,mCAAmC;oBACnC,IAAI,WAAW,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,aAAa,GAAG,CAAC,CAAC;oBACtB,GAAG,CAAC;wBACH,gFAAgF;wBAChF,uIAAuI;wBACvI,iEAAiE;wBACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC7D,IAAI,gBAAgB,EAAE,CAAC;4BACtB,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;gCAC7C,IACC,aAAa,GAAG,CAAC,IAAI,sGAAsG;oCAC3H,CAAC,CAAC,YAAY,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;oCAEvF,SAAS;gCACV,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oCACzC,SAAS;gCACV,CAAC;gCACD,IAAI,CAAC;oCACJ,IAAI,QAAQ,CAAC;oCACb,IAAI,YAAY,CAAC,oBAAoB,IAAI,YAAY,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;wCAChF,8FAA8F;wCAC9F,uFAAuF;wCACvF,0DAA0D;wCAC1D,QAAQ,GAAG,IAAI,CAAC;wCAChB,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;4CACjC,uGAAuG;4CACvG,IAAI,CAAC,mBAAmB;gDAAE,mBAAmB,GAAG,CAAC,YAAY,CAAC,CAAC;;gDAC1D,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wCAC7C,CAAC;wCACD,YAAY,CAAC,aAAa,GAAG,MAAM,CAAC;oCACrC,CAAC;oCACD,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gCACnE,CAAC;gCAAC,OAAO,KAAK,EAAE,CAAC;oCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;gCACb,CAAC;4BACF,CAAC;wBACF,CAAC;wBACD,IAAI,WAAW,IAAI,IAAI;4BAAE,MAAM;wBAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzE,IAAI,SAAS,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1C,aAAa,EAAE,CAAC,CAAC,8EAA8E;wBAChG,CAAC;wBACD,IAAI,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;4BACpB,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;wBACnD,CAAC;;4BAAM,WAAW,GAAG,IAAI,CAAC;oBAC3B,CAAC,QAAQ,IAAI,EAAE;gBAChB,CAAC;YACF,CAAC;iBAAM,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,6FAA6F;gBAC7F,gGAAgG;gBAChG,kGAAkG;gBAClG,iGAAiG;gBACjG,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;wBAC5D,KAAK,MAAM,YAAY,IAAI,gBAAgB,EAAE,CAAC;4BAC7C,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS;gCAAE,SAAS;4BAClD,IAAI,CAAC;gCACJ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;4BAC5D,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;4BACb,CAAC;wBACF,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,UAAU,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,CAAC;gBACpD,iFAAiF;gBACjF,oFAAoF;gBACpF,yFAAyF;gBACzF,4FAA4F;gBAC5F,aAAa,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;gBAC1D,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,CACjB,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CACrG,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAC3C,IAAI,mBAAmB,EAAE,CAAC;YACzB,iHAAiH;YACjH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;gBAChD,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW;gBAC9C,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnF,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,0FAA0F;QAC1F,iFAAiF;QACjF,IAAI,UAAU,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;IACnE,CAAC;AACF,CAAC;AACD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,YAAY,EAAE,UAAU;IACvD,MAAM,KAAK,GAAG,UAAU,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACrC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE;YACtC,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,wEAAwE;YAChI,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,uFAAuF;YACvF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7D,CAAC;YACD,0KAA0K;YAC1K,MAAM,YAAY,GAAG,GAAG,EAAE;gBACzB,wHAAwH;gBACxH,IAAI,CAAC,KAAK,CAAC,iBAAiB;oBAC3B,uCAAuC;oBACvC,KAAK,CAAC,iBAAiB,GAAG,IAAI,YAAY,CACzC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;gBACH,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,sBAAsB;gBACxF,IAAI,CAAC;oBACJ,yBAAyB,CAAC,aAAa,CAAC,CAAC;gBAC1C,CAAC;wBAAS,CAAC;oBACV,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,uBAAuB;oBAC/E,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB;gBAC7D,CAAC;YACF,CAAC,CAAC;YACF,iCAAiC;YACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,YAAY,CAAC;gBAAE,OAAO;YAChE,YAAY,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AACD,SAAS,eAAe,CAAC,UAAU;IAClC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;IACtC,IAAI,WAAW,CAAC;IAChB,UAAU,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,WAAW,GAAG,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,CAAC,OAAO,GAAG,WAAW,CAAC;AAClD,CAAC;AAED,SAAgB,mBAAmB,CAAC,UAAU;IAC7C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;QACjC,eAAe,CACd;YACC,YAAY,EAAE,UAAU;YACxB,UAAU;SACV,EACD,IAAI,EACJ,IAAI,EACJ,CAAC,EACD,EAAE,KAAK,EAAE,eAAe,EAAE,CAC1B,CAAC;QACF,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,eAAe,CAAC;AACnC,CAAC"}

package/dist/security/auth.js

@@ -50,13 +50,16 @@ const uuid_1 = require("uuid");
 const env = __importStar(require("../utility/environment/environmentManager.js"));
 const hdbTerms_ts_1 = require("../utility/hdbTerms.js");
 const harper_logger_ts_1 = __importDefault(require("../utility/logging/harper_logger.js"));
-const { forComponent, AuthAuditLog } = harper_logger_ts_1.default;
+const { forComponent, AuthAuditLog, errorForLog } = harper_logger_ts_1.default;
 const serverHandlers_js_1 = __importDefault(require("../server/itc/serverHandlers.js"));
 const { user } = serverHandlers_js_1.default;
 const Headers_ts_1 = require("../server/serverHelpers/Headers.js");
 const common_utils_ts_1 = require("../utility/common_utils.js");
 const index_ts_1 = require("./certificateVerification/index.js");
+const deferredAuthentication_ts_1 = require("./deferredAuthentication.js");
 const contentTypes_ts_1 = require("../server/serverHelpers/contentTypes.js");
+const hdbError_ts_1 = require("../utility/errors/hdbError.js");
+const { AUTHENTICATION_ERROR_MSGS, HTTP_STATUS_CODES } = hdbError_ts_1.hdbErrors;
 const authLogger = forComponent('authentication');
 const { debug } = authLogger;
 const authEventLog = authLogger.withTag('auth-event');
@@ -89,9 +92,6 @@ let AUTHORIZE_LOCAL = envFlag(process.env.AUTHENTICATION_AUTHORIZELOCAL) ??
 const LOG_AUTH_SUCCESSFUL = env.get(hdbTerms_ts_1.CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGSUCCESSFUL) ?? false;
 const LOG_AUTH_FAILED = env.get(hdbTerms_ts_1.CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGFAILED) ?? false;
 const DEFAULT_COOKIE_EXPIRES = 'Tue, 01 Oct 8307 19:33:20 GMT';
-// RFC 9111 cache-scope directives; boundaries on both sides so a token like `public-foo` doesn't match
-const SHARED_CACHE_OPTIN = /(^|[,\s])(public|s-maxage)($|[\s,;=])/i;
-const PRIVATE_SCOPE = /(^|[,\s])(private|no-store)($|[\s,;=])/i;
 let authorizationCache = new Map();
 Server_ts_1.server.onInvalidatedUser(() => {
     // TODO: Eventually we probably want to be able to invalidate individual users
@@ -214,7 +214,13 @@ async function authentication(request, nextHandler) {
             // already authenticated
         }
         else if (authorization) {
-            const cachedUser = authorizationCache.get(authorization);
+            let cachedUser = authorizationCache.get(authorization);
+            // A cached Bearer identity must not outlive its token: expiry is the only revocation
+            // mechanism for scoped tokens, so it has to be exact, not cache-TTL-fuzzy.
+            if (cachedUser?.authExpiresAt && cachedUser.authExpiresAt * 1000 <= Date.now()) {
+                authorizationCache.delete(authorization);
+                cachedUser = undefined;
+            }
             if (cachedUser?.role) {
                 // Shallow-clone so verifyPerms's `role.permission = fullRolePerms` reassignment
                 // doesn't mutate the cache entry (defense-in-depth; operations and other
@@ -229,6 +235,7 @@ async function authentication(request, nextHandler) {
                 const strategy = authorization.slice(0, spaceIndex);
                 const credentials = authorization.slice(spaceIndex + 1);
                 let username, password;
+                let credentialRejection;
                 try {
                     switch (strategy) {
                         case 'Basic':
@@ -259,12 +266,21 @@ async function authentication(request, nextHandler) {
                                             status: -1,
                                         });
                                     }
-                                    catch {
+                                    catch (refreshError) {
+                                        // Preserve refresh-validation faults; only a tagged rejection permits falling
+                                        // back to the original operation-token rejection.
+                                        if (!(0, deferredAuthentication_ts_1.isCredentialRejection)(refreshError))
+                                            throw refreshError;
                                         throw error;
                                     }
                                 }
+                                // A non-'invalid token' rejection (e.g. expired) must propagate, not fall
+                                // through to caching an undefined user (which would read as anonymous).
+                                throw error;
                             }
                             break;
+                        default:
+                            throw (0, deferredAuthentication_ts_1.credentialRejectionError)(AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL, HTTP_STATUS_CODES.UNAUTHORIZED);
                     }
                 }
                 catch (err) {
@@ -275,18 +291,29 @@ async function authentication(request, nextHandler) {
                             authAuditLog(username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.FAILURE, strategy);
                         }
                     }
-                    return applyResponseHeaders({
-                        status: 401,
-                        body: (0, contentTypes_ts_1.serializeMessage)({ error: err.message }, request),
-                    });
+                    const internalFault = !(0, deferredAuthentication_ts_1.isCredentialRejection)(err);
+                    if (request.isOperationsServer || internalFault) {
+                        if (internalFault)
+                            authLogger.error('Authentication failed internally', errorForLog(err));
+                        return applyResponseHeaders({
+                            status: 401,
+                            body: (0, contentTypes_ts_1.serializeMessage)({ error: internalFault ? AUTHENTICATION_ERROR_MSGS.GENERIC_AUTH_FAIL : err.message }, request),
+                        });
+                    }
+                    credentialRejection = err;
                 }
-                authorizationCache.set(authorization, newUser);
-                if (LOG_AUTH_SUCCESSFUL)
-                    authAuditLog(newUser.username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS, strategy);
-                // Shallow-clone so verifyPerms's `role.permission = fullRolePerms` reassignment
-                // doesn't mutate the just-stored cache entry (defense-in-depth).
-                if (newUser?.role) {
-                    newUser = { ...newUser, role: { ...newUser.role, permission: { ...newUser.role.permission } } };
+                if (credentialRejection) {
+                    (0, deferredAuthentication_ts_1.deferCredentialRejection)(request, credentialRejection, strategy);
+                }
+                else {
+                    authorizationCache.set(authorization, newUser);
+                    if (LOG_AUTH_SUCCESSFUL && newUser != null)
+                        authAuditLog(newUser.username, hdbTerms_ts_1.AUTH_AUDIT_STATUS.SUCCESS, strategy);
+                    // Shallow-clone so verifyPerms's `role.permission = fullRolePerms` reassignment
+                    // doesn't mutate the just-stored cache entry (defense-in-depth).
+                    if (newUser?.role) {
+                        newUser = { ...newUser, role: { ...newUser.role, permission: { ...newUser.role.permission } } };
+                    }
                 }
             }
             request.user = newUser;
@@ -376,15 +403,18 @@ async function authentication(request, nextHandler) {
             return response;
         if (response.status === 401) {
             wasUnauthorized = true;
-            if (headers['user-agent']?.startsWith('Mozilla') &&
-                headers.accept?.startsWith('text/html') &&
-                Resources_ts_1.resources.loginPath) {
-                // on the web if we have a login page, default to redirecting to it
-                response.status = 302;
-                response.headers.set('Location', Resources_ts_1.resources.loginPath(request));
-            } // the HTTP specified way of indicating HTTP authentication methods supported:
-            else
-                response.headers.set('WWW-Authenticate', 'Basic');
+            // Downstream owns the challenge or redirect after Harper deferred the credential decision.
+            if (!(0, deferredAuthentication_ts_1.getDeferredCredentialRejection)(request)) {
+                if (headers['user-agent']?.startsWith('Mozilla') &&
+                    headers.accept?.startsWith('text/html') &&
+                    Resources_ts_1.resources.loginPath) {
+                    // on the web if we have a login page, default to redirecting to it
+                    response.status = 302;
+                    response.headers.set('Location', Resources_ts_1.resources.loginPath(request));
+                } // the HTTP specified way of indicating HTTP authentication methods supported:
+                else
+                    response.headers.set('WWW-Authenticate', 'Basic');
+            }
         }
         return applyResponseHeaders(response);
     }
@@ -397,7 +427,8 @@ async function authentication(request, nextHandler) {
         // if we are rejecting the credentials (401, possibly rewritten to a login redirect); such a
         // response must never be stored by a shared cache and served to a different principal (#1565)
         const rejectedAuth = response?.status === 401 || wasUnauthorized;
-        const identityDependent = !!request.user || rejectedAuth;
+        // A downstream response produced under the untouched credential remains identity-dependent (#1565).
+        const identityDependent = !!request.user || rejectedAuth || !!(0, deferredAuthentication_ts_1.getDeferredCredentialRejection)(request);
         // with CORS enabled the response is origin-dependent — ACAO reflects the request Origin, and
         // its absence when no Origin was sent is origin-dependent too — so a shared cache must
         // partition on Origin either way (#1518)
@@ -427,16 +458,16 @@ async function authentication(request, nextHandler) {
                         ? existingCacheControl.join(', ')
                         : existingCacheControl
                     : '';
-                const optedIn = !rejectedAuth && SHARED_CACHE_OPTIN.test(cacheControlString);
+                const optedIn = !rejectedAuth && Headers_ts_1.SHARED_CACHE_OPTIN.test(cacheControlString);
                 if (!optedIn) {
                     (0, Headers_ts_1.addVaryHeader)(headers, 'Authorization');
                     if (ENABLE_SESSIONS)
                         (0, Headers_ts_1.addVaryHeader)(headers, 'Cookie');
                     // a 401 never opts into shared caching: any non-private Cache-Control it carries is
                     // replaced outright (an existing private/no-store is already at least as strict)
-                    if (!cacheControlString || (rejectedAuth && !PRIVATE_SCOPE.test(cacheControlString)))
+                    if (!cacheControlString || (rejectedAuth && !Headers_ts_1.PRIVATE_SCOPE.test(cacheControlString)))
                         headers.set('Cache-Control', 'private, no-cache');
-                    else if (!PRIVATE_SCOPE.test(cacheControlString))
+                    else if (!Headers_ts_1.PRIVATE_SCOPE.test(cacheControlString))
                         headers.set('Cache-Control', cacheControlString + ', private');
                 }
             }

package/dist/security/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../security/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DA,gCAGC;AAGD,wCAyVC;AAQD,8CAOC;AAGD,sBAQC;AAED,wBAIC;AA7bD,uCAAyC;AACzC,mDAA6C;AAC7C,4DAAsD;AACtD,qEAAuH;AACvH,4DAA8D;AAC9D,+BAAkC;AAClC,kFAAoE;AACpE,wDAA4F;AAC5F,2FAA+D;AAC/D,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,0BAAY,CAAC;AACpD,wFAA6D;AAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,2BAAc,CAAC;AAChC,mEAA4E;AAC5E,gEAAyD;AACzD,iEAAuE;AACvE,6EAA2E;AAC3E,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;AAC7B,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AACtD,GAAG,CAAC,QAAQ,EAAE,CAAC;AAEf,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,mBAAmB,CAAC,CAAC;AACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,SAAS,CAAC,CAAC;AAClD,MAAM,wBAAwB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,oCAAoC,CAAC,CAAC;AAC7F,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,0BAA0B,CAAC,CAAC;AAEzE,MAAM,aAAa,GAAG,IAAA,oBAAK,EAAQ;IAClC,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CAClE,CAAC,CAAC;AACH,SAAS,eAAe;IACvB,OAAO,aAAa,CAAC;AACtB,CAAC;AACD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,IAAI,IAAI,CAAC;AACrF,6FAA6F;AAC7F,oEAAoE;AACpE,SAAS,OAAO,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,EAAE,CAAC;AAC1E,CAAC;AACD,gIAAgI;AAChI,IAAI,eAAe,GAClB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC;IACpD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,MAAM,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qCAAqC,CAAC,IAAI,KAAK,CAAC;AAClG,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC;AAE1F,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAE/D,uGAAuG;AACvG,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AACnC,kBAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;IAC7B,8EAA8E;IAC9E,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AACH,IAAI,UAAe,CAAC;AACpB,SAAgB,UAAU;IACzB,eAAe,GAAG,IAAI,CAAC;IACvB,UAAU,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACrG,CAAC;AAED,yFAAyF;AAClF,KAAK,UAAU,cAAc,CAAC,OAAO,EAAE,WAAW;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,uEAAuE;IACjH,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,mFAAmF;IACnF,6CAA6C;IAC7C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACJ,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB;gBAC5C,CAAC,CAAC,cAAc;oBACf,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,EAAE;gBACL,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,yBAAyB,GAC9B,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,kCAAkC,CAAC,IAAI,qCAAqC,CAAC;oBAEpG,oBAAoB;oBACpB,MAAM,OAAO,GAAG,IAAI,oBAAO,CAAC;wBAC3B,CAAC,8BAA8B,EAAE,wCAAwC,CAAC;wBAC1E,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;wBAC3D,CAAC,6BAA6B,EAAE,MAAM,CAAC;wBACvC,8FAA8F;wBAC9F,CAAC,MAAM,EAAE,QAAQ,CAAC;qBAClB,CAAC,CAAC;oBACH,IAAI,eAAe;wBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;oBAC7E,OAAO;wBACN,MAAM,EAAE,GAAG;wBACX,OAAO;qBACP,CAAC;gBACH,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,eAAe;oBAAE,eAAe,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,CAAC;QACF,CAAC;QACD,IAAI,SAAS,CAAC;QACd,IAAI,OAAO,CAAC;QACZ,IAAI,eAAe,EAAE,CAAC;YACrB,sGAAsG;YACtG,gCAAgC;YAChC,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YACnC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;YAClH,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAChF,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACjD,MAAM;gBACP,CAAC;YACF,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,YAAY,CAC3B,QAAQ,EACR,MAAM,EACN,8BAAgB,CAAC,cAAc,EAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,EAAE,EACxC,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CAChB,CAAC;YACD,GAAW,CAAC,aAAa,GAAG,QAAQ,CAAC;YACtC,IAAI,SAAS;gBAAG,GAAW,CAAC,UAAU,GAAG,SAAS,CAAC;YACnD,IAAI,OAAO,CAAC,SAAS,CAAC;gBAAG,GAAW,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,CAAC,QAAQ,CAAC;gBAAG,GAAW,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE/D,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO;gBAAE,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;;gBAC9D,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,IACC,CAAC,OAAO,CAAC,UAAU;YACnB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,eAAe,CAAC,OAAO;YAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB;YAEjD,YAAY,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAE9F,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YACjF,MAAM,kBAAkB,GAAG,MAAM,IAAA,4BAAiB,EAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAChG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBAC/B,YAAY,CAAC,KAAK,EAAE,CACnB,kCAAkC,EAClC,kBAAkB,CAAC,MAAM,EACzB,KAAK,EACL,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAClC,CAAC;gBACF,OAAO,oBAAoB,CAAC;oBAC3B,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,IAAA,kCAAgB,EAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,OAAO,CAAC;iBACxF,CAAC,CAAC;YACJ,CAAC;YAED,uFAAuF;YACvF,2EAA2E;YAC3E,kCAAkC;YAClC,mEAAmE;YACnE,yBAAyB;YACzB,IAAI;YAEJ,IAAI,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,sFAAsF;gBACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,IAAI;oBAC5E,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,YAAY,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,sEAAsE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,wBAAwB;QACzB,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;gBACtB,gFAAgF;gBAChF,yEAAyE;gBACzE,0FAA0F;gBAC1F,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YAC1G,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACvB,OAAO,GAAG,UAAU,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBACxD,IAAI,QAAQ,EAAE,QAAQ,CAAC;gBACvB,IAAI,CAAC;oBACJ,QAAQ,QAAQ,EAAE,CAAC;wBAClB,KAAK,OAAO;4BACX,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;4BAClC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;4BACxC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;4BACzC,gFAAgF;4BAChF,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC1F,MAAM;wBACP,KAAK,QAAQ;4BACZ,IAAI,CAAC;gCACJ,OAAO,GAAG,MAAM,IAAA,+CAAsB,EAAC,WAAW,CAAC,CAAC;gCACpD,4EAA4E;gCAC5E,gDAAgD;gCAChD,MAAM,OAAO,GAAG,IAAA,kCAAS,EAAC,WAAW,CAAC,CAAC;gCACvC,IAAI,OAAO,IAAI,OAAO,EAAE,GAAG;oCAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC;4BAClE,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCAChB,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;oCACvC,2FAA2F;oCAC3F,IAAI,CAAC;wCACJ,MAAM,IAAA,6CAAoB,EAAC,WAAW,CAAC,CAAC;wCACxC,OAAO,oBAAoB,CAAC;4CAC3B,4EAA4E;4CAC5E,0CAA0C;4CAC1C,MAAM,EAAE,CAAC,CAAC;yCACV,CAAC,CAAC;oCACJ,CAAC;oCAAC,MAAM,CAAC;wCACR,MAAM,KAAK,CAAC;oCACb,CAAC;gCACF,CAAC;4BACF,CAAC;4BACD,MAAM;oBACR,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,eAAe,EAAE,CAAC;wBACrB,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;4BACpB,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;4BACjD,YAAY,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC7D,CAAC;oBACF,CAAC;oBAED,OAAO,oBAAoB,CAAC;wBAC3B,MAAM,EAAE,GAAG;wBACX,IAAI,EAAE,IAAA,kCAAgB,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC;qBACvD,CAAC,CAAC;gBACJ,CAAC;gBAED,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBAC/C,IAAI,mBAAmB;oBAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC7F,gFAAgF;gBAChF,iEAAiE;gBACjE,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;oBACnB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;gBACjG,CAAC;YACF,CAAC;YAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,2CAA2C;YAC3C,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;aAAM,IACN,CAAC,eAAe,IAAI,UAAU,CAAC,IAAI,kEAAkE;YACrG,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC;YAC9E,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;gBAChD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe;gBACtD,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,qCAAqC;UAC/D,CAAC;YACF,OAAO,CAAC,IAAI,GAAG,UAAU,IAAI,CAAC,MAAM,IAAA,sBAAY,GAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,cAAc;gBAChD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,CAAC;gBACrE,MAAM,SAAS,GACd,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAC5B,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;oBACtC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;oBACtC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,SAAS,GAAG,IAAA,SAAI,GAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,CAAC;oBACrE,MAAM,aAAa,GAAG,OAAO;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC3D,CAAC,CAAC,sBAAsB,CAAC;oBAC1B,MAAM,MAAM,GACX,OAAO,CAAC,IAAI;wBACZ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;4BACxB,6CAA6C;4BAC7C,qGAAqG;4BACrG,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;4BACrD,sFAAsF;4BACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAC5C,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;4BAChF,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAC9B,CAAC,CAAC,CAAC;oBACJ,MAAM,YAAY,GACjB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;oBAC9F,kEAAkE;oBAClE,wDAAwD;oBACxD,IAAI,MAAM,GAAG,GAAG,YAAY,GAAG,SAAS,qBAAqB,aAAa,YAAY,CAAC;oBACvF,IAAI,MAAM,EAAE,CAAC;wBACZ,MAAM,IAAI,YAAY,MAAM,EAAE,CAAC;oBAChC,CAAC;oBAED,IAAI,SAAS,EAAE,CAAC;wBACf,MAAM,IAAI,yBAAyB,CAAC;oBACrC,CAAC;oBACD,IAAI,eAAe,EAAE,CAAC;wBACrB,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5C,CAAC;yBAAM,IAAI,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;wBACnC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5C,CAAC;gBACF,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACf,uDAAuD;oBACvD,gFAAgF;oBAChF,2DAA2D;oBAC3D,IAAI,eAAe,EAAE,CAAC;wBACrB,IAAI,MAAM;4BAAE,eAAe,CAAC,IAAI,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;wBACnF,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;oBACjD,CAAC;yBAAM,IAAI,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;wBACnC,IAAI,MAAM;4BAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;wBACnF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;oBACjD,CAAC;gBACF,CAAC;gBACD,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;gBAC9B,OAAO,eAAe,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE;oBAC5C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;iBAClE,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,CAAC,KAAK,GAAG,KAAK,WAAW,QAAgB,EAAE,QAAiB,EAAE,KAAc;gBAClF,MAAM,IAAI,GAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK;oBACtC,CAAC,CAAC,MAAM,IAAA,2CAAkB,EAAC,KAAK,CAAC;oBACjC,CAAC,CAAC,MAAM,kBAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,eAAe,GAAG,IAAI,CAAC;YACvB,IACC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;gBAC5C,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC;gBACvC,wBAAS,CAAC,SAAS,EAClB,CAAC;gBACF,mEAAmE;gBACnE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;gBACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,CAAC,CAAC,8EAA8E;;gBAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,SAAS,oBAAoB,CAAC,QAAQ;QACrC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC;QACjC,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QACjE,MAAM,iBAAiB,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;QACzD,6FAA6F;QAC7F,uFAAuF;QACvF,yCAAyC;QACzC,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,IAAI,iBAAiB,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjF,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC/B,iEAAiE;YACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU;gBAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,GAAG,IAAI,oBAAO,CAAC,OAAO,CAAC,CAAC;YACrG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;gBACxB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,WAAW;gBAAE,IAAA,0BAAa,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,6EAA6E;YAC7E,gFAAgF;YAChF,+EAA+E;YAC/E,sFAAsF;YACtF,6EAA6E;YAC7E,mFAAmF;YACnF,+BAA+B;YAC/B,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC1D,MAAM,kBAAkB,GAAG,oBAAoB;oBAC9C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;wBACpC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;wBACjC,CAAC,CAAC,oBAAoB;oBACvB,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,IAAA,0BAAa,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;oBACxC,IAAI,eAAe;wBAAE,IAAA,0BAAa,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBACtD,oFAAoF;oBACpF,iFAAiF;oBACjF,IAAI,CAAC,kBAAkB,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;wBACnF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;yBAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,GAAG,WAAW,CAAC,CAAC;gBACjE,CAAC;YACF,CAAC;QACF,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AACD,WAAW,CAAC,GAAG,EAAE;IAChB,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;IACrB,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AACH,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,SAAgB,iBAAiB,CAAC,KAA6C;IAC9E,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,EAA4C,CAAC;IACnG,MAAM,QAAQ,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,UAAU,EAAU,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,EAAU,CAAC;IAC/F,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,aAAa;AACN,KAAK,UAAU,KAAK,CAAC,WAAW;IACtC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7E,oGAAoG;IACpG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtD,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACzG,OAAO,kBAAkB,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,YAAY;IACxC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChF,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,mBAAmB,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../security/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,gCAGC;AAGD,wCA4XC;AAQD,8CAOC;AAGD,sBAQC;AAED,wBAIC;AApeD,uCAAyC;AACzC,mDAA6C;AAC7C,4DAAsD;AACtD,qEAAuH;AACvH,4DAA8D;AAC9D,+BAAkC;AAClC,kFAAoE;AACpE,wDAA4F;AAC5F,2FAA+D;AAC/D,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,0BAAY,CAAC;AACjE,wFAA6D;AAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,2BAAc,CAAC;AAChC,mEAA+G;AAC/G,gEAAyD;AACzD,iEAAuE;AACvE,2EAKqC;AACrC,6EAA2E;AAC3E,+DAA0D;AAC1D,MAAM,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,uBAAS,CAAC;AACnE,MAAM,UAAU,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;AAC7B,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AACtD,GAAG,CAAC,QAAQ,EAAE,CAAC;AAEf,MAAM,kBAAkB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,mBAAmB,CAAC,CAAC;AACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,SAAS,CAAC,CAAC;AAClD,MAAM,wBAAwB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,oCAAoC,CAAC,CAAC;AAC7F,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,0BAA0B,CAAC,CAAC;AAEzE,MAAM,aAAa,GAAG,IAAA,oBAAK,EAAQ;IAClC,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;CAClE,CAAC,CAAC;AACH,SAAS,eAAe;IACvB,OAAO,aAAa,CAAC;AACtB,CAAC;AACD,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,IAAI,IAAI,CAAC;AACrF,6FAA6F;AAC7F,oEAAoE;AACpE,SAAS,OAAO,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,EAAE,CAAC;AAC1E,CAAC;AACD,gIAAgI;AAChI,IAAI,eAAe,GAClB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IAClD,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC;IACpD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,MAAM,mBAAmB,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,qCAAqC,CAAC,IAAI,KAAK,CAAC;AAClG,MAAM,eAAe,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,iCAAiC,CAAC,IAAI,KAAK,CAAC;AAE1F,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAE/D,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AACnC,kBAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;IAC7B,8EAA8E;IAC9E,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AACH,IAAI,UAAe,CAAC;AACpB,SAAgB,UAAU;IACzB,eAAe,GAAG,IAAI,CAAC;IACvB,UAAU,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACrG,CAAC;AAED,yFAAyF;AAClF,KAAK,UAAU,cAAc,CAAC,OAAO,EAAE,WAAW;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,uEAAuE;IACjH,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,mFAAmF;IACnF,6CAA6C;IAC7C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACJ,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,OAAO,CAAC,kBAAkB;gBAC5C,CAAC,CAAC,cAAc;oBACf,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,EAAE;gBACL,CAAC,CAAC,QAAQ;oBACT,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,yBAAyB,GAC9B,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,kCAAkC,CAAC,IAAI,qCAAqC,CAAC;oBAEpG,oBAAoB;oBACpB,MAAM,OAAO,GAAG,IAAI,oBAAO,CAAC;wBAC3B,CAAC,8BAA8B,EAAE,wCAAwC,CAAC;wBAC1E,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;wBAC3D,CAAC,6BAA6B,EAAE,MAAM,CAAC;wBACvC,8FAA8F;wBAC9F,CAAC,MAAM,EAAE,QAAQ,CAAC;qBAClB,CAAC,CAAC;oBACH,IAAI,eAAe;wBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;oBAC7E,OAAO;wBACN,MAAM,EAAE,GAAG;wBACX,OAAO;qBACP,CAAC;gBACH,CAAC;gBACD,eAAe,CAAC,IAAI,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,eAAe;oBAAE,eAAe,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvF,CAAC;QACF,CAAC;QACD,IAAI,SAAS,CAAC;QACd,IAAI,OAAO,CAAC;QACZ,IAAI,eAAe,EAAE,CAAC;YACrB,sGAAsG;YACtG,gCAAgC;YAChC,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YACnC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;YAClH,MAAM,OAAO,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAChF,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACjD,MAAM;gBACP,CAAC;YACF,CAAC;YACD,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,YAAY,CAC3B,QAAQ,EACR,MAAM,EACN,8BAAgB,CAAC,cAAc,EAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,EAAE,EACxC,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CAChB,CAAC;YACD,GAAW,CAAC,aAAa,GAAG,QAAQ,CAAC;YACtC,IAAI,SAAS;gBAAG,GAAW,CAAC,UAAU,GAAG,SAAS,CAAC;YACnD,IAAI,OAAO,CAAC,SAAS,CAAC;gBAAG,GAAW,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,CAAC,QAAQ,CAAC;gBAAG,GAAW,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE/D,IAAI,MAAM,KAAK,+BAAiB,CAAC,OAAO;gBAAE,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;;gBAC9D,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC,CAAC;QAEF,IACC,CAAC,OAAO,CAAC,UAAU;YACnB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,eAAe,CAAC,OAAO;YAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB;YAEjD,YAAY,CAAC,KAAK,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAE9F,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YACjF,MAAM,kBAAkB,GAAG,MAAM,IAAA,4BAAiB,EAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YAChG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBAC/B,YAAY,CAAC,KAAK,EAAE,CACnB,kCAAkC,EAClC,kBAAkB,CAAC,MAAM,EACzB,KAAK,EACL,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAClC,CAAC;gBACF,OAAO,oBAAoB,CAAC;oBAC3B,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,IAAA,kCAAgB,EAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,EAAE,OAAO,CAAC;iBACxF,CAAC,CAAC;YACJ,CAAC;YAED,uFAAuF;YACvF,2EAA2E;YAC3E,kCAAkC;YAClC,mEAAmE;YACnE,yBAAyB;YACzB,IAAI;YAEJ,IAAI,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,sFAAsF;gBACtF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,IAAI;oBAC5E,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7D,YAAY,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,sEAAsE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,wBAAwB;QACzB,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YAC1B,IAAI,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACvD,qFAAqF;YACrF,2EAA2E;YAC3E,IAAI,UAAU,EAAE,aAAa,IAAI,UAAU,CAAC,aAAa,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAChF,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACzC,UAAU,GAAG,SAAS,CAAC;YACxB,CAAC;YACD,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;gBACtB,gFAAgF;gBAChF,yEAAyE;gBACzE,0FAA0F;gBAC1F,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YAC1G,CAAC;iBAAM,IAAI,UAAU,EAAE,CAAC;gBACvB,OAAO,GAAG,UAAU,CAAC;YACtB,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACpD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;gBACxD,IAAI,QAAQ,EAAE,QAAQ,CAAC;gBACvB,IAAI,mBAAmB,CAAC;gBACxB,IAAI,CAAC;oBACJ,QAAQ,QAAQ,EAAE,CAAC;wBAClB,KAAK,OAAO;4BACX,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;4BAClC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACxC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;4BACxC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;4BACzC,gFAAgF;4BAChF,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;4BAC1F,MAAM;wBACP,KAAK,QAAQ;4BACZ,IAAI,CAAC;gCACJ,OAAO,GAAG,MAAM,IAAA,+CAAsB,EAAC,WAAW,CAAC,CAAC;gCACpD,4EAA4E;gCAC5E,gDAAgD;gCAChD,MAAM,OAAO,GAAG,IAAA,kCAAS,EAAC,WAAW,CAAC,CAAC;gCACvC,IAAI,OAAO,IAAI,OAAO,EAAE,GAAG;oCAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC;4BAClE,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCAChB,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;oCACvC,2FAA2F;oCAC3F,IAAI,CAAC;wCACJ,MAAM,IAAA,6CAAoB,EAAC,WAAW,CAAC,CAAC;wCACxC,OAAO,oBAAoB,CAAC;4CAC3B,4EAA4E;4CAC5E,0CAA0C;4CAC1C,MAAM,EAAE,CAAC,CAAC;yCACV,CAAC,CAAC;oCACJ,CAAC;oCAAC,OAAO,YAAY,EAAE,CAAC;wCACvB,8EAA8E;wCAC9E,kDAAkD;wCAClD,IAAI,CAAC,IAAA,iDAAqB,EAAC,YAAY,CAAC;4CAAE,MAAM,YAAY,CAAC;wCAC7D,MAAM,KAAK,CAAC;oCACb,CAAC;gCACF,CAAC;gCACD,0EAA0E;gCAC1E,wEAAwE;gCACxE,MAAM,KAAK,CAAC;4BACb,CAAC;4BACD,MAAM;wBACP;4BACC,MAAM,IAAA,oDAAwB,EAC7B,yBAAyB,CAAC,iBAAiB,EAC3C,iBAAiB,CAAC,YAAY,CAC9B,CAAC;oBACJ,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,eAAe,EAAE,CAAC;wBACrB,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;4BACpB,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;4BACjD,YAAY,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC7D,CAAC;oBACF,CAAC;oBAED,MAAM,aAAa,GAAG,CAAC,IAAA,iDAAqB,EAAC,GAAG,CAAC,CAAC;oBAClD,IAAI,OAAO,CAAC,kBAAkB,IAAI,aAAa,EAAE,CAAC;wBACjD,IAAI,aAAa;4BAAE,UAAU,CAAC,KAAK,CAAC,kCAAkC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC1F,OAAO,oBAAoB,CAAC;4BAC3B,MAAM,EAAE,GAAG;4BACX,IAAI,EAAE,IAAA,kCAAgB,EACrB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EACpF,OAAO,CACP;yBACD,CAAC,CAAC;oBACJ,CAAC;oBACD,mBAAmB,GAAG,GAAG,CAAC;gBAC3B,CAAC;gBAED,IAAI,mBAAmB,EAAE,CAAC;oBACzB,IAAA,oDAAwB,EAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;gBAClE,CAAC;qBAAM,CAAC;oBACP,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;oBAC/C,IAAI,mBAAmB,IAAI,OAAO,IAAI,IAAI;wBACzC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,+BAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBACrE,gFAAgF;oBAChF,iEAAiE;oBACjE,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;wBACnB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;oBACjG,CAAC;gBACF,CAAC;YACF,CAAC;YAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,2CAA2C;YAC3C,OAAO,CAAC,IAAI,GAAG,MAAM,kBAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;aAAM,IACN,CAAC,eAAe,IAAI,UAAU,CAAC,IAAI,kEAAkE;YACrG,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC;YAC9E,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;gBAChD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe;gBACtD,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,qCAAqC;UAC/D,CAAC;YACF,OAAO,CAAC,IAAI,GAAG,UAAU,IAAI,CAAC,MAAM,IAAA,sBAAY,GAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,cAAc;gBAChD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,CAAC;gBACrE,MAAM,SAAS,GACd,OAAO,CAAC,QAAQ,KAAK,OAAO;oBAC5B,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;oBACtC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC;oBACtC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,SAAS,GAAG,IAAA,SAAI,GAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,6BAA6B,CAAC,CAAC;oBACrE,MAAM,aAAa,GAAG,OAAO;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;wBAC3D,CAAC,CAAC,sBAAsB,CAAC;oBAC1B,MAAM,MAAM,GACX,OAAO,CAAC,IAAI;wBACZ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;4BACxB,6CAA6C;4BAC7C,qGAAqG;4BACrG,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gCAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;4BACrD,sFAAsF;4BACtF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAC5C,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;4BAChF,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;wBAC9B,CAAC,CAAC,CAAC;oBACJ,MAAM,YAAY,GACjB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;oBAC9F,kEAAkE;oBAClE,wDAAwD;oBACxD,IAAI,MAAM,GAAG,GAAG,YAAY,GAAG,SAAS,qBAAqB,aAAa,YAAY,CAAC;oBACvF,IAAI,MAAM,EAAE,CAAC;wBACZ,MAAM,IAAI,YAAY,MAAM,EAAE,CAAC;oBAChC,CAAC;oBAED,IAAI,SAAS,EAAE,CAAC;wBACf,MAAM,IAAI,yBAAyB,CAAC;oBACrC,CAAC;oBACD,IAAI,eAAe,EAAE,CAAC;wBACrB,eAAe,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5C,CAAC;yBAAM,IAAI,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;wBACnC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBAC5C,CAAC;gBACF,CAAC;gBACD,IAAI,SAAS,EAAE,CAAC;oBACf,uDAAuD;oBACvD,gFAAgF;oBAChF,2DAA2D;oBAC3D,IAAI,eAAe,EAAE,CAAC;wBACrB,IAAI,MAAM;4BAAE,eAAe,CAAC,IAAI,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;wBACnF,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;oBACjD,CAAC;yBAAM,IAAI,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;wBACnC,IAAI,MAAM;4BAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,eAAe,CAAC,CAAC;wBACnF,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;oBACjD,CAAC;gBACF,CAAC;gBACD,cAAc,CAAC,EAAE,GAAG,SAAS,CAAC;gBAC9B,OAAO,eAAe,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE;oBAC5C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;iBAClE,CAAC,CAAC;YACJ,CAAC,CAAC;YACF,OAAO,CAAC,KAAK,GAAG,KAAK,WAAW,QAAgB,EAAE,QAAiB,EAAE,KAAc;gBAClF,MAAM,IAAI,GAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK;oBACtC,CAAC,CAAC,MAAM,IAAA,2CAAkB,EAAC,KAAK,CAAC;oBACjC,CAAC,CAAC,MAAM,kBAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/D,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,eAAe,GAAG,IAAI,CAAC;YACvB,2FAA2F;YAC3F,IAAI,CAAC,IAAA,0DAA8B,EAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,IACC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;oBAC5C,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC;oBACvC,wBAAS,CAAC,SAAS,EAClB,CAAC;oBACF,mEAAmE;oBACnE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;oBACtB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,wBAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChE,CAAC,CAAC,8EAA8E;;oBAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;QACF,CAAC;QACD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,SAAS,oBAAoB,CAAC,QAAQ;QACrC,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC;QACjC,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QACjE,oGAAoG;QACpG,MAAM,iBAAiB,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,IAAI,CAAC,CAAC,IAAA,0DAA8B,EAAC,OAAO,CAAC,CAAC;QACtG,6FAA6F;QAC7F,uFAAuF;QACvF,yCAAyC;QACzC,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,IAAI,iBAAiB,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjF,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC/B,iEAAiE;YACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU;gBAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,GAAG,IAAI,oBAAO,CAAC,OAAO,CAAC,CAAC;YACrG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;gBACxB,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,WAAW;gBAAE,IAAA,0BAAa,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,6EAA6E;YAC7E,gFAAgF;YAChF,+EAA+E;YAC/E,sFAAsF;YACtF,6EAA6E;YAC7E,mFAAmF;YACnF,+BAA+B;YAC/B,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC1D,MAAM,kBAAkB,GAAG,oBAAoB;oBAC9C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;wBACpC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;wBACjC,CAAC,CAAC,oBAAoB;oBACvB,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,+BAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,IAAA,0BAAa,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;oBACxC,IAAI,eAAe;wBAAE,IAAA,0BAAa,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBACtD,oFAAoF;oBACpF,iFAAiF;oBACjF,IAAI,CAAC,kBAAkB,IAAI,CAAC,YAAY,IAAI,CAAC,0BAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;wBACnF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;yBAC9C,IAAI,CAAC,0BAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC;wBAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,GAAG,WAAW,CAAC,CAAC;gBACjE,CAAC;YACF,CAAC;QACF,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AACD,WAAW,CAAC,GAAG,EAAE;IAChB,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,2BAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;IACrB,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC;AACH,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,SAAgB,iBAAiB,CAAC,KAA6C;IAC9E,IAAI,OAAO;QAAE,OAAO;IACpB,OAAO,GAAG,IAAI,CAAC;IACf,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAQ,KAAK,CAAC,OAAO,CAAC,MAAM,EAA4C,CAAC;IACnG,MAAM,QAAQ,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,UAAU,EAAU,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,EAAU,CAAC;IAC/F,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,aAAa;AACN,KAAK,UAAU,KAAK,CAAC,WAAW;IACtC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7E,oGAAoG;IACpG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACtD,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IACzG,OAAO,kBAAkB,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,YAAY;IACxC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChF,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,mBAAmB,CAAC;AAC5B,CAAC"}

package/dist/security/authn/oidc/claims.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Issuer-agnostic claim matching and constraint validation (#2171).
+ *
+ * Pure — no network, no storage, and nothing that knows which issuer a token came from. Rules that
+ * depend on the issuer live in providers/.
+ */
+import type { ClaimConstraint, TokenClaims } from './types.ts';
+/**
+ * Returns undefined on a match, or the first failure's reason — for the log, never the caller.
+ *
+ * A constrained claim absent from the token fails rather than passes, so a policy cannot be weakened
+ * by an issuer that stops emitting a claim.
+ */
+export declare function matchTrustPolicyClaims(claims: TokenClaims, policyClaims: Record<string, ClaimConstraint>): string | undefined;
+/**
+ * Validates the *shape* of a policy's constraints — that each is a usable set of comparable values.
+ * Whether the set is specific enough to be safe depends on the issuer; that is the provider profile's
+ * assertPolicyIsSpecific.
+ *
+ * Throws ClientError naming the first problem; the reader is an administrator writing a policy.
+ */
+export declare function validateClaimConstraintShape(policyClaims: unknown): asserts policyClaims is Record<string, ClaimConstraint>;

package/dist/security/authn/oidc/claims.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Issuer-agnostic claim matching and constraint validation (#2171).
+ *
+ * Pure — no network, no storage, and nothing that knows which issuer a token came from. Rules that
+ * depend on the issuer live in providers/.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchTrustPolicyClaims = matchTrustPolicyClaims;
+exports.validateClaimConstraintShape = validateClaimConstraintShape;
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+/** Issuers may encode a numeric id as a JSON number; anything non-scalar is not comparable. */
+function claimToString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
+/**
+ * Returns undefined on a match, or the first failure's reason — for the log, never the caller.
+ *
+ * A constrained claim absent from the token fails rather than passes, so a policy cannot be weakened
+ * by an issuer that stops emitting a claim.
+ */
+function matchTrustPolicyClaims(claims, policyClaims) {
+    const constraints = Object.entries(policyClaims);
+    // validateClaimConstraintShape rejects this at write time; this backstops a row that reached the
+    // table another way, such as replication from a peer.
+    if (constraints.length === 0)
+        return 'policy constrains no claims';
+    for (const [claimName, constraint] of constraints) {
+        const actual = claimToString(claims[claimName]);
+        if (actual === undefined || actual === '')
+            return `token has no usable ${claimName} claim`;
+        const accepted = Array.isArray(constraint) ? constraint : [constraint];
+        // Exact membership, deliberately — never a prefix, wildcard, or regex. Relaxing this to
+        // something like `startsWith` is the classic trusted-publishing escalation: a policy pinning
+        // `HarperFast/my-app` would then also admit `HarperFast/my-app-evil`, a repository anyone can
+        // create. unitTests/security/authn/oidc/claims.test.js pins both argument orders.
+        if (!accepted.includes(actual))
+            return `${claimName} does not match the policy`;
+    }
+    return undefined;
+}
+/**
+ * Validates the *shape* of a policy's constraints — that each is a usable set of comparable values.
+ * Whether the set is specific enough to be safe depends on the issuer; that is the provider profile's
+ * assertPolicyIsSpecific.
+ *
+ * Throws ClientError naming the first problem; the reader is an administrator writing a policy.
+ */
+function validateClaimConstraintShape(policyClaims) {
+    if (!policyClaims || typeof policyClaims !== 'object' || Array.isArray(policyClaims)) {
+        throw new hdbError_ts_1.ClientError('claims must be an object of claim constraints');
+    }
+    const entries = Object.entries(policyClaims);
+    if (entries.length === 0)
+        throw new hdbError_ts_1.ClientError('claims must constrain at least one claim');
+    for (const [claimName, constraint] of entries) {
+        const values = Array.isArray(constraint) ? constraint : [constraint];
+        if (values.length === 0)
+            throw new hdbError_ts_1.ClientError(`claims.${claimName} must accept at least one value`);
+        for (const value of values) {
+            if (typeof value !== 'string' || value === '') {
+                throw new hdbError_ts_1.ClientError(`claims.${claimName} must be a non-empty string or an array of non-empty strings`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=claims.js.map

package/dist/security/authn/oidc/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../../security/authn/oidc/claims.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAkBH,wDAoBC;AASD,oEAmBC;AAhED,qEAAkE;AAGlE,+FAA+F;AAC/F,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACrC,MAAmB,EACnB,YAA6C;IAE7C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,iGAAiG;IACjG,sDAAsD;IACtD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAC;IAEnE,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,uBAAuB,SAAS,QAAQ,CAAC;QAC3F,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvE,wFAAwF;QACxF,6FAA6F;QAC7F,8FAA8F;QAC9F,kFAAkF;QAClF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,SAAS,4BAA4B,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,4BAA4B,CAC3C,YAAqB;IAErB,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,yBAAW,CAAC,+CAA+C,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,YAAuC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAW,CAAC,0CAA0C,CAAC,CAAC;IAE5F,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,yBAAW,CAAC,UAAU,SAAS,iCAAiC,CAAC,CAAC;QACrG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC/C,MAAM,IAAI,yBAAW,CAAC,UAAU,SAAS,8DAA8D,CAAC,CAAC;YAC1G,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/security/authn/oidc/identityToken.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Identity-token verification for OIDC trusted publishing (#2171).
+ *
+ * Verifies that a token was signed by the configured issuer and is addressed to this instance.
+ * Matching it against a policy's claim constraints is separate (claims.ts), because one verification
+ * serves every policy sharing an issuer and audience.
+ */
+import type { KeyObject } from 'node:crypto';
+import type { TokenClaims } from './types.ts';
+export interface VerifyTokenTarget {
+    issuer: string;
+    audience: string;
+}
+export interface VerifyTokenOptions {
+    /** Overridable for tests; defaults to the network-backed JWKS lookup. */
+    getSigningKey?: (issuer: string, kid: unknown) => Promise<KeyObject>;
+    /** Seconds since the epoch to evaluate expiry against; defaults to the real clock. */
+    clockTimestamp?: number;
+}
+/**
+ * Refuses a token. Shared with the exchange so both halves fail identically: the endpoint is
+ * unauthenticated, and a caller told exactly which check failed can probe a policy one claim at a
+ * time. The reason goes to the log instead.
+ */
+export declare function rejectToken(detail: string): never;
+/** Verifies a CI identity token against one issuer/audience pair and returns its normalized claims. */
+export declare function verifyIdentityToken(token: unknown, target: VerifyTokenTarget, options?: VerifyTokenOptions): Promise<TokenClaims>;

package/dist/security/authn/oidc/identityToken.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Identity-token verification for OIDC trusted publishing (#2171).
+ *
+ * Verifies that a token was signed by the configured issuer and is addressed to this instance.
+ * Matching it against a policy's claim constraints is separate (claims.ts), because one verification
+ * serves every policy sharing an issuer and audience.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rejectToken = rejectToken;
+exports.verifyIdentityToken = verifyIdentityToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const hdbError_ts_1 = require("../../../utility/errors/hdbError.js");
+const logger_ts_1 = require("../../../utility/logging/logger.js");
+const jwks_ts_1 = require("./jwks.js");
+const index_ts_1 = require("./providers/index.js");
+const logger = (0, logger_ts_1.loggerWithTag)('oidc-trust');
+/**
+ * Asymmetric signatures only. Passing this to jwt.verify is what prevents algorithm confusion: an
+ * `alg: none` token, or one HMAC-signed with a public key as the secret, is rejected before the
+ * signature is considered.
+ */
+const ALLOWED_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'PS256',
+    'PS384',
+    'PS512',
+];
+const CLOCK_TOLERANCE_SECONDS = 60;
+/** CI identity tokens are minted per job and live minutes; a far-future expiry is not one to honor. */
+const MAX_TOKEN_LIFETIME_SECONDS = 3_600;
+/**
+ * Refuses a token. Shared with the exchange so both halves fail identically: the endpoint is
+ * unauthenticated, and a caller told exactly which check failed can probe a policy one claim at a
+ * time. The reason goes to the log instead.
+ */
+function rejectToken(detail) {
+    logger.warn?.(`Rejecting identity token: ${detail}`);
+    throw new hdbError_ts_1.ClientError('Identity token was rejected', 401);
+}
+/** Verifies a CI identity token against one issuer/audience pair and returns its normalized claims. */
+async function verifyIdentityToken(token, target, options = {}) {
+    if (typeof token !== 'string' || token === '')
+        throw new hdbError_ts_1.ClientError('token is required');
+    const issuer = (0, jwks_ts_1.normalizeIssuer)(target.issuer);
+    if (typeof target.audience !== 'string' || target.audience === '') {
+        throw new hdbError_ts_1.ClientError('audience is required');
+    }
+    const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
+    if (!decoded)
+        rejectToken('token is not a well-formed JWT');
+    // Checked before resolving a key so a garbage header costs no outbound request.
+    if (!ALLOWED_ALGORITHMS.includes(decoded.header.alg)) {
+        rejectToken(`unsupported algorithm ${decoded.header.alg}`);
+    }
+    const getSigningKey = options.getSigningKey ?? jwks_ts_1.getSigningKey;
+    const key = await getSigningKey(issuer, decoded.header.kid);
+    let payload;
+    try {
+        payload = jsonwebtoken_1.default.verify(token, key, {
+            algorithms: ALLOWED_ALGORITHMS,
+            // Both spellings, because `issuer` here is normalized (trailing slash stripped) while
+            // jsonwebtoken compares it byte-for-byte against the raw `iss`. Azure AD v1 emits
+            // `https://sts.windows.net/<tenant>/`, which would otherwise never authenticate — and the
+            // generic profile exists precisely to serve issuers like it with no provider code. This
+            // cannot widen trust: normalizeIssuer already maps the two forms to one value, which is
+            // what keys the JWKS cache, the discovery check, and the policy lookup.
+            issuer: [issuer, `${issuer}/`],
+            audience: target.audience,
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            ...(options.clockTimestamp === undefined ? {} : { clockTimestamp: options.clockTimestamp }),
+        });
+    }
+    catch (error) {
+        rejectToken(error.message);
+    }
+    // jsonwebtoken only enforces `exp` when present, so a token without one never expires.
+    if (typeof payload.exp !== 'number')
+        rejectToken('token has no exp claim');
+    // `iat` is REQUIRED by OIDC, and required here rather than treated as optional: skipping the
+    // ceiling when it is absent means a token carrying a distant `exp` and no `iat` is unbounded —
+    // the ceiling would silently not apply to exactly the token that most needs it.
+    if (typeof payload.iat !== 'number')
+        rejectToken('token has no iat claim');
+    // Bounded against the verification clock, not only as `exp - iat`. jsonwebtoken validates `exp`
+    // and `nbf` but never rejects a future `iat`, so an issuer that shifts the whole pair forward
+    // keeps a small delta and still hands out a token valid far longer than the ceiling. Both the
+    // delta and the absolute distance to `exp` are checked; the tolerance mirrors the one given to
+    // jwt.verify so genuine clock skew is not treated as an attack.
+    const now = options.clockTimestamp ?? Math.floor(Date.now() / 1000);
+    if (payload.iat > now + CLOCK_TOLERANCE_SECONDS)
+        rejectToken('token iat is in the future');
+    if (payload.exp - payload.iat > MAX_TOKEN_LIFETIME_SECONDS) {
+        rejectToken(`token lifetime exceeds ${MAX_TOKEN_LIFETIME_SECONDS}s`);
+    }
+    if (payload.exp - now > MAX_TOKEN_LIFETIME_SECONDS + CLOCK_TOLERANCE_SECONDS) {
+        rejectToken(`token expires more than ${MAX_TOKEN_LIFETIME_SECONDS}s from now`);
+    }
+    // No `jti` requirement: not every issuer emits one (Azure uses `uti`, others omit it), and the
+    // exchange keys replay on a hash of the token itself, which is universal.
+    return (0, index_ts_1.profileForIssuer)(issuer).normalizeClaims(payload);
+}
+//# sourceMappingURL=identityToken.js.map

package/dist/security/authn/oidc/identityToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identityToken.js","sourceRoot":"","sources":["../../../../security/authn/oidc/identityToken.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;AAmDH,kCAGC;AAGD,kDAiEC;AAxHD,gEAAoE;AAEpE,qEAAkE;AAClE,kEAAmE;AACnE,uCAAmF;AACnF,mDAAwD;AAGxD,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,YAAY,CAAC,CAAC;AAE3C;;;;GAIG;AACH,MAAM,kBAAkB,GAAgB;IACvC,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACP,CAAC;AAEF,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,uGAAuG;AACvG,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAczC;;;;GAIG;AACH,SAAgB,WAAW,CAAC,MAAc;IACzC,MAAM,CAAC,IAAI,EAAE,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,yBAAW,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,uGAAuG;AAChG,KAAK,UAAU,mBAAmB,CACxC,KAAc,EACd,MAAyB,EACzB,UAA8B,EAAE;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,IAAI,yBAAW,CAAC,mBAAmB,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,yBAAW,CAAC,sBAAsB,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAE5D,gFAAgF;IAChF,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAgB,CAAC,EAAE,CAAC;QACnE,WAAW,CAAC,yBAAyB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAoB,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE5D,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE;YAChC,UAAU,EAAE,kBAAkB;YAC9B,sFAAsF;YACtF,kFAAkF;YAClF,0FAA0F;YAC1F,wFAAwF;YACxF,wFAAwF;YACxF,wEAAwE;YACxE,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,uBAAuB;YACvC,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;SAC3F,CAAe,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,WAAW,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,uFAAuF;IACvF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC3E,6FAA6F;IAC7F,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAE3E,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,gEAAgE;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,uBAAuB;QAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,0BAA0B,EAAE,CAAC;QAC5D,WAAW,CAAC,0BAA0B,0BAA0B,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,0BAA0B,GAAG,uBAAuB,EAAE,CAAC;QAC9E,WAAW,CAAC,2BAA2B,0BAA0B,YAAY,CAAC,CAAC;IAChF,CAAC;IACD,+FAA+F;IAC/F,0EAA0E;IAE1E,OAAO,IAAA,2BAAgB,EAAC,MAAM,CAAC,CAAC,eAAe,CAAC,OAAsB,CAAC,CAAC;AACzE,CAAC"}

package/dist/security/authn/oidc/jwks.d.ts

@@ -0,0 +1,25 @@
+/**
+ * OIDC discovery and JWKS retrieval for trusted publishing (#2171).
+ *
+ * The issuer's signing keys are the root of trust for an exchanged token, and the endpoint that
+ * reaches them is unauthenticated — hence HTTPS only, bounded body, bounded time, and a rate limit
+ * on the refetch an unrecognized `kid` triggers, without which forged `kid`s become one outbound
+ * fetch per request.
+ */
+import { type KeyObject } from 'node:crypto';
+/** Drops all cached key sets. Exported for tests and for an operator forcing a re-read. */
+export declare function clearJwksCache(): void;
+/**
+ * Canonicalizes an issuer URL. The result is both the cache key and the discovery base, so a policy
+ * stored with a trailing slash and one without must not become two entries for the same issuer.
+ */
+export declare function normalizeIssuer(issuer: unknown): string;
+/** Resolves the public key an issuer used to sign a token, by `kid`. */
+/**
+ * `now` exists so the two time-based bounds below can be tested — the cache TTL and, more
+ * importantly, the STALE_KEY_GRACE_MS ceiling that stops a pulled key being honored forever through
+ * a prolonged outage. Reaching either otherwise needs a cache aged past an hour, and this repo bars
+ * new fake timers. Mirrors the `clockTimestamp` seam verifyIdentityToken already takes, rather than
+ * inventing a second convention. Callers in production pass nothing.
+ */
+export declare function getSigningKey(issuer: string, kid: unknown, now?: number): Promise<KeyObject>;